In the Linux kernel, the following vulnerability has been resolved: pagepool: keep fragoffset aligned for odd-sized requests…
CVE-2026-99127
In the Linux kernel, the following vulnerability has been resolved: pagepool: keep fragoffset aligned for odd-sized requests pagepoolallocfragnetmem() rounds the requested fragment size with size = ALIGN(size, dmagetcachealignment()); dmagetcachealignment() returns 1 unless the architecture defines ARCHDMAMINALIGN, which DMA-coherent architectures such as x86 do not. There the ALIGN() is a no-op and pool->fragoffset advances by the raw, unrounded size. A single caller asking for an odd size then leaves fragoffset misaligned for every fragment carved out of that page afterwards. The pool is shared, so the damage is not confined to the caller that caused it. The per-cpu systempagepool used by generic XDP hits this. skbppcowdata() allocates its fragments with the raw packet length: size = mint(u32, len, PAGESIZE); truesize = size; page = pagepooldevalloc(pool, &pageoff, &truesize); leaving fragoffset odd for whatever is carved out of that page next. Its own head allocation is already aligned -- SKBHEADALIGN(size) plus the XDPPACKETHEADROOM its callers pass -- so it is a later user of the shared pool that pays: pagepooldevallocva() returns a misaligned buffer, napibuildskb() installs…
Assessment
- CVSS
- Not yet scored
- Severity
- Unscored
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 28 October 2026
- Last updated
- 30 October 2026
- Assigner
- 416baaa9-dc9f-4396-8d5f-8c081fb06d67
At the source
References
- https://git.kernel.org/stable/c/22b67b0f59f5a7f4fa1e6043a1987e167c5d06d2
- https://git.kernel.org/stable/c/31e1a71995f23446c9d9e6ba170a6b16b110d243
- https://git.kernel.org/stable/c/813a72beaa5d3f4bb135e0def9b3f07a3511ca0e
- https://git.kernel.org/stable/c/8ab058f49e801803c4a755b09fe4a920d194da7f
- https://git.kernel.org/stable/c/ccc28e498ef1c6eaaa16e61c6edb52c32a4f14bb
- https://git.kernel.org/stable/c/dc0df5a0c62ccea1d0e08d39a4dc9064de81d411
- https://git.kernel.org/stable/c/dca1b51693c81eaf77e50980be373e01ae857394
Community proofs of concept
No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.
Submit a proof of concept
Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-99127